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Abstract 

We propose a model for deterministic distributed function computation by a network of identical 
and anonymous nodes. In this model, each node has bounded computation and storage capabil- 
ities that do not grow with the network size. Furthermore, each node only knows its neighbors, 
not the entire graph. Our goal is to characterize the class of functions that can be computed 
within this model. In our main result, we provide a necessary condition for computability which 
we show to be nearly sufficient, in the sense that every function that violates this condition 
can at least be approximated. The problem of computing (suitably rounded) averages in a dis- 
tributed manner plays a central role in our development; we provide an algorithm that solves it 
in time that grows quadratically with the size of the network. 



1 Introduction 

The goal of many multi-agent systems, distributed computation algorithms, and decentralized 
data fusion methods is to have a set of nodes compute a common value based on initial values 
or observations at each node. Towards this purpose, the nodes, which we will sometimes refer 
to as agents, perform some internal computations and repeatedly communicate with each other. 
The objective of this paper is to understand the fundamental limitations and capabilities of such 
systems and algorithms when the available information and computational resources at each node 
are limited. 

1.1 Motivation 

The model that we will employ is a natural one for many different settings, including the case of 
wireless sensor networks. However, before describing the model, we start with a few examples that 
motivate the questions that we address. 

(a) Quantized consensus: Suppose that each node begins with an integer value Xj(0)e {0, . . . , K}. 
We would like the nodes to end up, at some later time, with values yi that are almost equal, i.e., 
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\Ui — Uj\ < 1) for all i,j, while preserving the sum of the values, i.e., Yli=i = Y17=l Vi- This is 
the so-called quantized averaging problem, which has received considerable attention recently; see, 
e.g., [201 [131 El [Ml E]- It may be viewed as the problem of computing the function (1/n) Ya=i Xi -> 
rounded to an integer value. 

(b) Distributed hypothesis testing and majority voting: Consider n sensors interested in 
deciding between two hypotheses, Hq and Hi. Each sensor collects measurements and makes a 
preliminary decision X{ G {0, 1} in favor of one of the hypotheses. The sensors would like to make 
a final decision by majority vote, in which case they need to compute the indicator function of the 
event Y17=l Xi — n /^i m a distributed way. Alternatively, in a weighted majority vote, they may be 
interested in computing the indicator function of an event such as Ya=1 Xi — 3fi/4. A variation of 
this problem involves the possibility that some sensors abstain from the vote, perhaps due to their 
inability to gather sufficiently reliable information. 

(c) Direction coordination on a ring: Consider n vehicles placed on a ring, each with some 
arbitrarily chosen direction of motion (clockwise or counterclockwise). We would like the n vehicles 
to agree on a single direction of motion. A variation of this problem was considered in [29J, 
where, however, additional requirements on the vehicles were imposed which we do not consider 
here. The solution provided in |29j was semi-centralized in the sense that vehicles had unique 
numerical identifiers, and the final direction of most vehicles was set to the direction of the vehicle 
with the largest identifier. We wonder whether the direction coordination problem can be solved 
in a completely decentralized way. Furthermore, we would like the final direction of motion to 
correspond to the initial direction of the majority of the vehicles: if, say, 90% of the vehicles are 
moving counterclockwise, we would like the other 10% to turn around. If we define x% to be 1 
when the ith vehicle is initially oriented clockwise, and if it is oriented counterclockwise, then, 
coordinating on a direction involves the distributed computation of the indicator function of the 
event Y^i=\ x i — n/2. 

(d) Solitude verification: This is the problem of checking whether exactly one node has a given 
state. This problem is of interest if we want to avoid simultaneous transmissions over a common 
channel [T7], or if we want to maintain a single leader (as in motion coordination — see for example 
[19]) Given states Xi E {0, 1, . . . , K}, solitude verification is equivalent to the problem of computing 
the binary function which is equal to 1 if and only if \{i : X{ = 0}| = 1. 

There are numerous methods that have been proposed for solving problems such as the above; 
see for example the vast and growing literature on consensus and averaging methods, or the dis- 
tribute robotics literature [9]. Oftentimes, different algorithms involve different computational 
capabilities on the part of the nodes, which makes it hard to talk about a "best" algorithm. At 
the same time, simple algorithms (such as setting up a spanning tree and aggregating information 
by progressive summations over the tree) are often considered undesirable because they require 
too much coordination or global information. It should be clear that a sound discussion of such 
issues requires the specification of a precise model of computation, followed by a systematic analysis 
of fundamental limitations under a given model. This is precisely the objective of this paper: to 
propose a particular model, and to characterize the class of functions computable under this model. 

1.2 The features of our model 

Our model provides an abstraction for common requirements for distributed algorithms in the wire- 
less sensor network literature. We model the nodes as interacting deterministic finite automata that 
exchange messages on a fixed bidirectional network, with no time delays or unreliable transmissions. 
Some important qualitative features of our model are the following. 
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Identical nodes: Any two nodes with the same number of neighbors must run the same algorithm. 
Note that this assumption is equivalent to assuming that the nodes are exactly identical. Any 
algorithm that works in this setting will also work if the nodes are not all identical, since the nodes 
can still run the same algorithm. 

Anonymity: A node can distinguish its neighbors using its own, private, local identifiers. However, 
nodes do not have global identifiers. In other words, a node receiving a message from one of its 
neighbors can send an answer to precisely that neighbor, or recognize that a later message comes 
from this same neighbor. On the other hand, nodes do not a priori have a unique signature that 
can be recognized by every other node. 

Determinism: Randomization is not allowed. This restriction is imposed in order to preclude 
essentially centralized solutions that rely on randomly generated distinct identifiers and thus by- 
pass the anonymity requirement. Clearly, developing algorithms is much harder, and sometimes 
impossible, when randomization is disallowed. 

Limited memory: We focus on the case where the nodes can be described by finite automata, 
and pay special attention to the required memory size. Ideally, the number of memory bits required 
at each node should be bounded above by a slowly growing function of the degree of a node. 

Absence of global information: Nodes have no global information, and do not even have an 
upper bound on the total number of nodes. Accordingly, the algorithm that each node is running 
is independent of the network size and topology. 

Convergence requirements: Nodes hold an estimated output that must converge to a desired 
value which is a function of all nodes' initial observations or values. In particular, for the case of 
discrete outputs, all nodes must eventually settle on the desired value. On the other hand, the 
nodes do not need to become aware of such termination, which is anyway impossible in the absence 
of any global information [6]. 

In this paper, we only consider the special case of fixed graph topologies, where the under- 
lying (and unknown) interconnection graph does not change with time. Developing a meaningful 
model for the time-varying case and extending our algorithms to that case is an interesting topic, 
but outside the scope of this paper. 



1.3 Literature review 

There is a very large literature on distributed function computation in related models of computa- 
tion [H[25]. This literature can be broadly divided into two strands, although the separation is not 
sharp: works that address general computability issues for various models, and works that focus 
on the computation of specific functions, such as the majority function or the average. We start 
by discussing the first strand. 

A common model in the distributed computing literature involves the requirement that all pro- 
cesses terminate once the desired output is produced and that nodes become aware that termination 
has occurred. A consequence of the termination requirement is that nodes typically need to know 
the network size n (or an upper bound on n) to compute non-trivial functions. We refer the reader 
to [U El l36| l2T| 131] for some fundamental results in this setting, and to [14J for a comprehensive 
summary of known results. Closest to our work is the reference [11] which provides an impossibility 



result very similar to our Theorem 3.1 for a closely related model computation. 

The biologically-inspired "population algorithm" model of distributed computation has some 
features in common with our model, namely, anonymous, bounded- resource nodes, and no require- 
ment of termination awareness; see [2] for an overview of available results. However, this model 
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involves a different type of node interactions from the ones we consider; in particular, nodes interact 
pairwise at times that may be chosen adversarially. 

Regarding the computation of specific functions, [26] shows the impossibility of majority voting 
if the nodes are limited to a binary state. Some experimental memoryless algorithms (which are not 
guaranteed to always converge to the correct answer) have been proposed in the physics literature 
|16| . Several papers have quantified the performance of simple heuristics for computing specific 
functions, typically in randomized settings. We refer the reader to |18j . which studied simple 
heuristics for computing the majority function, and to [34J, which provides a heuristic that has 
guarantees only for the case of complete graphs. 

The large literature on quantized averaging often tends to involve themes similar to those 
addressed in this paper [131 EH El Ell EDJ- However, the underlying models of computation are 
typically more powerful than ours, as they allow for randomization and unbounded memory. Closer 
to the current paper, [32] develops an algorithm with 0(n 2 ) convergence time for a variant of the 
quantized averaging problem, but requires unbounded memory. Reference [7J provides an algorithm 
for the particular quantized averaging problem that we consider in Section [4] (called in [7J the 
"interval consensus problem"), which uses randomization but only bounded memory (a total of 
two bits at each node). An upper bound on its expected convergence time is provided in |12j 
as a function of n and a spectral quantity related to the network. A precise convergence time 
bound, as a function of n, is not given. Similarly, the algorithm in [37] runs in 0(n 5 ) time for the 
case of fixed graphs. (However, we note that [37] also addresses an asynchronous model involving 
time-varying graphs.) Roughly speaking, the algorithms in [7J [37] work by having positive and 
negative "load tokens" circulate randomly in the network until they meet and annihilate each 
other. Our algorithm involves a similar idea. However, at the cost of some algorithmic complexity, 
our algorithm is deterministic. This allows for fast progress, in contrast to the slow progress of 
algorithms that need to wait until the coalescence time of two independent random walks. Finally, 
a deterministic algorithm for computing the majority function (and some more general functions) 
was proposed in [28J . However, the algorithm appears to rely on the computation of shortest path 
lengths, and thus requires unbounded memory at each node. 

Semi-centralized versions of the problem, in which the nodes ultimately transmit to a fusion 
center, have often been considered in the literature, e.g., for distributed statistical inference |30| 
or detection [23J . The papers [15] , [22] , and [27] consider the complexity of computing a function 
and communicating its value to a sink node. We refer the reader to the references therein for an 
overview of existing results in such semi-centralized settings. However, the underlying model is 
fundamentally different from ours, because the presence of a fusion center violates our anonymity 
assumption. 

Broadly speaking, our results differ from previous works in several key respects: (i) Our model, 
which involves totally decentralized computation, deterministic algorithms, and constraints on 
memory and computation resources at the nodes, but does not require the nodes to know when the 
computation is over, is different from that considered in almost all of the relevant literature, (ii) 
Our focus is on identifying computable and non-computable functions under our model, and we 



achieve a nearly tight separation, as evidenced by a comparison between Theorem 3.1 and Corollary 
4.3 (iii) Our 0(n 2 ) averaging algorithm is quite different, and significantly faster than available 



memory-limited algorithms. 

1.4 Summary and Contributions 

We provide a general model of decentralized anonymous computation on fixed graphs, with the 



features described in Section 1.2, and characterize the type of functions of the initial values that 
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can be computed. 

We prove that if a function is computable under our model, then its value can only depend 
on the frequencies of the different possible initial values. For example, if the initial values are 
binary, a computable function can only depend on po := \{i : Xi = 0}|/n and p\ := \{i : Xi = l}|/n. 
In particular, determining the number of nodes, or whether at least two nodes have an initial value 
of 1, is impossible. 

Conversely, we prove that if a function only depends on the frequencies of the different possible 
initial values (and is measurable), then the function can be approximated with any given preci- 
sion, except possibly on a set of frequency vectors of arbitrarily small volume. Moreover, if the 
dependence on these frequencies can be expressed through a combination of linear inequalities with 
rational coefficients, then the function is computable exactly. In particular, the functions involved 
in the quantized consensus, distributed hypothesis testing, and direction coordination examples 
are computable, whereas the function involved in solitude verification is not. Similarly, statistical 
measures such as the standard deviation of the distribution of the initial values can be approx- 
imated with arbitrary precision. Finally, we show that with infinite memory, the frequencies of 
the different initial values (i.e., po, p\ in the binary case) are computable exactly, thus obtaining a 
precise characterization of the computable functions in this case. 

The key to our positive results is a new algorithm for calculating the (suitably quantized) 
average of the initial values, which is of independent interest. The algorithm does not involve 
randomization, requires only 0(n 2 ) time to terminate, and the memory (number of bits) required 
at each node is only logarithmic in the node's degree. In contrast, existing algorithms either require 
unbounded memory, or are significantly slower to converge. 

1.5 Outline 

In Section [2j we describe formally our model of computation. In Section [3j we establish necessary 
conditions for a function to be computable. In Section [4j we provide sufficient conditions for a 
function to be computable or approximable. Our positive results rely on an algorithm that keeps 
track of nodes with maximal values, and an algorithm that calculates a suitably rounded average 
of the nodes' initial values; these are described in Sections [5] and [6j respectively. We provide some 
corroborating simulations in Setion[7| and we end with some concluding remarks, in Section [8j 

2 Formal description of the model 

Under our model, a distributed computing system consists of three elements: 

(a) A network: A network is a triple (n, G, £), where n is the number of nodes, and G = (V, E) 
is a connected bidirectional graph G = (V, E) with n nodes. (By bidirectional, we mean that the 
graph is directed but if (i,j) G E, then (j, i) £ E.) We define d(i) as the in-degree (and also 
out-degree, hence "degree" for short) of node i. Finally, £ is a port labeling which assigns a port 
number (a distinct integer in the set {0, 1, . . . ,d(i)}) to each outgoing edge of any node i. Note 
that the unique identifiers i used to refer to nodes are only introduced for the purpose of analysis, 
and are not part of the actual system. In particular, nodes do not know and cannot use their 
identifiers. 

(b) Input and output sets: The input set is a finite set X = {0, 1, . . . ,K} to which the initial 
value of each node belongs. The output set is a finite set Y to which the output of each node 
belongs. 
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(c) An algorithm: An algorithm is denned as a family of finite automata (Ad)d=i 2 where the 
automaton Ad describes the behavior of a node with degree d. The state of the automaton Ad 
is a tuple [x, z, y; (mi, . . . , m^)]; we will call x £ X the initial value, z £ the internal memory 
state, y £ Y the output or estimated answer, and mi,...,m^ £ M the outgoing messages. The 
sets Zd and M are assumed finite. We allow the cardinality of Zd to increase with d. Clearly, this 
would be necessary for any algorithm that needs to store the messages received in the previous 
time step. Each automaton Ad is identified with a transition law from Ix^xFx M d into itself, 
which maps each [x, z, y; (mi, . . . , m^)] to some [x, z' , y'; (m^, . . . , m' d )] . In words, at each iteration, 
the automaton takes x, z, y, and incoming messages into account, to create a new memory state, 
output, and (outgoing) messages, but does not change the initial value. 

Given the above elements of a distributed computing system, an algorithm proceeds as fol- 
lows. For convenience, we assume that the above defined sets Y, Zd, and M contain a spe- 
cial element, denoted by 0. Each node i begins with an initial value i; £ I and implements 
the automaton Ama, initialized with x = x% and z = y = mi = ••• = md = 0. We use 
Si(t) = [xi,yi(t), Zi{t),mi t i{t), . . . ,m it d(i)(t)} to denote the state of node i's automaton at time 
t. Consider a particular node i. Let ji, ■ ■ ■ ,jdU) De an enumeration of its neighbors, according to 
the port numbers. (Thus, jk is the node at the other end of the fcth outgoing edge at node i.) Let 
Pk be the port number assigned to link (jk,i) according to the port labeling at node jk- At each 
time step, node i carries out the following update: 

[x h Zi(t + 1), + 1); m iyl (t + 1), . . . , m M(l) (t + 1)] = A d{i) [x h Zi(t),yi(t);m juPl (*),..., m jdWtPdW (t)] . 

In words, the messages m Jfc)Pfe (t), k = 1, . . . , d{i), "sent" by the neighbors of i into the ports leading 
to i are used to transition to a new state and create new messages m^j^f + 1), k = 1, . . . , d(i), that 
i "sends" to its neighbors at time t + 1. We say that the algorithm terminates if there exists some 
y* £Y (called the final output of the algorithm) and a time t! such that yi(t) = y* for every i and 
t > t'. 

Consider now a family of functions (/n)n=l,2,~> wnere fn '■ X n -4 Y. We say that such a 
family is computable if there exists a family of automata (Ad)d=i,2,... such that for any n, for any 
network (n,G,C), and any set of initial conditions x±, . . . ,x n , the resulting algorithm terminates 
and the final output is f n (x\, . . . , x n ). Intuitively, a family of functions is computable if there is a 
bounded-memory algorithm which allows the nodes to "eventually" learn the value of the function 
in any connected topology and for any initial conditions. 

As an exception to the above definitions, we note that although we primarily focus on the finite 
case, we will briefly consider in Section [4] function families (/ n )n=i,2,... computable with infinite 
memory, by which we mean that the internal memory sets Zd and the output set Y are countably 
infinite, the rest of the model remaining the same. 

The rest of the paper focuses on the following general question: what families of functions 
are computable, and how can we design a corresponding algorithm (Ad)d=i,2,...? To illustrate the 
nature of our model and the type of algorithms that it supports, we provide a simple example. 

Detection problem: In this problem, all nodes start with a binary initial value Xi S {0, 1} = X. 
We wish to detect whether at least one node has an initial value equal to 1. We are thus dealing 
with the function family (/ n )n=l,2,...> where f n {x\, ■ ■ ■ , x n ) = max{a?i, . . . , x n }. This function family 
is computable by a family of automata with binary messages, binary internal state, and with the 
following transition rule: 

if Xi = 1 or Zi(t) = 1 or m&Xj.^j^ & E m ji(i) = 1 then 
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set Zi(t+1) =yi(t + l) = 1 

send mij{t + 1) = 1 to every neighbor j of i 

else 

set Zi(t + 1) = yi(t + l) = 
send mij(t + 1) = to every neighbor j of i 
end if 

In the above algorithm, we initialize by setting my(0), y«(0), and £j(0) to zero instead of the 
special symbol 0. One can easily verify that if x% = for every i, then = for all i and t. If 
on the other hand = 1 for some fc, then at each time step i, those nodes i at distance less than 
t from will have yi(t) = 1. Thus, for connected graphs, the algorithm will terminate within n 
steps, with the correct output. It is important to note, however, that because n is unknown, a node 
i can never know whether its current output Ui(t) is the final one. In particular, if yi{t) = 0, node 
i cannot exclude the possibility that Xj i = l for some node whose distance from i is larger than t. 

3 Necessary condition for computability 

In this section we establish our main negative result, namely, that if a function family is computable, 
then the final output can only depend on the frequencies of the different possible initial values. 
Furthermore, this remains true even if we allow for infinite memory, or restrict to networks in 
which neighboring nodes share a common label for the edges that join them. This result is quite 
similar to Theorem 3 of |llj . and so is the proof. Nevertheless, we provide a proof in order to keep 
the paper self-contained. 

We first need some definitions. Recall that X = {0, 1, . . . , K}. We let D be the unit simplex, 
that is, D = {{po, ■ ■ ■ ,Pk) £ [0, 1]^ +1 : Ylk=oPk = !}• We say that a function h : D — ^ Y 
corresponds to a function family (f n )n=i,2,... if f° r every n and every x £ X n , we have 

f(xi, ... ,x n ) = h (j>q(xi, . . . ,x n ),pi(xi, . . .,x n ), . . . ,pk(xi, ■ ■ ■ ,x n )) , 

where 

p k (xi, . . . , x n ) = \{i | Xi = k}\/n, 

so that Pk(xi, . . . , x n ) is the frequency of occurrence of the initial value k. In this case, we say that 
the family (f n ) is frequency-based. Note that n is used in defining the notion of frequency, but its 
value is unknown to the agents, and cannot be used in the computations. 

Theorem 3.1. Suppose that the family (f n ) is computable with infinite memory. Then, this 
family is frequency-based. The result remains true even if we only require computability over edge- 
labeled networks. 

The following are some applications of Theorem |3.1| 

(a) The parity function Ya=i Xi ( m °d k) is not computable, for any k > 1. 

(b) In a binary setting (X = {0, 1}), checking whether the number of nodes with X{ = 1 is larger 
than or equal to the number of nodes with xi = plus 10 is not computable. 

(c) Solitude verification, i.e., checking whether \i : {xj = 0}| = 1, is not computable. 

(d) An aggregate difference function such as Yli<j I 

not computable, even if it is to be 

calculated modulo k. 
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3.1 Proof of Theorem I37T1 



The proof of Theorem 3.1 involves a particular degree-two network (a ring), in which all port 
numbers take values in the set {0, 1,2}, and in which any two edges and have the same 
port number, as represented in Fig. [TJ More precisely, it relies on showing that two rings obtained 
by repeating, respectively, k and k' times the same sequences of nodes, edges, and initial conditions 
are algorithmically indistinguishable, and that any computable family of functions must thus take 
the same value on two such rings. The proof proceeds through a sequence of intermediate results, 
starting with the following lemma, which essentially reflects the fact that the node identifiers used 
in our analysis do not influence the course of the algorithm. It can be easily proved by induction 
on time, and its proof is omitted. The second lemma states that the value taken by computable 
(families of) functions may not depend on which particular node has which initial condition. 

Lemma 3.1. Suppose that G = ({1, . . . , n}, E) and G' = ({1, . . . , n}, E') are isomorphic; that 
is, there exists a permutation ir such that (i,j) £ E if and only if (n(i), 7r(j')) £ E' . Furthermore, 
suppose that the port label at node i for the edge leading to j in G is the same as the port label 
at node 7r(i) for the edge leading to 7r(j) in G' . Then, the state Si{t) resulting from the initial 
values xi, . . . ,x n on the graph G is the same as the state S^^^t) resulting from the initial values 
x^-im, ■ ■ ■ ,x n -i( n \ on the graph G' . 

Lemma 3.2. Suppose that the family (f n )n=i,2,... is computable with infinite memory on edge- 
labeled networks. Then, each fi is invariant under permutations of its arguments. 

Proof. Let ir^ be the permutation that swaps i with j (leaving the other nodes intact); with a 
slight abuse of notation, we also denote by TTij the mapping from X n to X n that swaps the iih and 
jth elements of a vector. (Note that ir^ 1 = iTij.) We show that for all x € X n , f n (x) = f n (^ij{x)). 

We run our distributed algorithm on the n-node complete graph with an edge labeling. Note 
that at least one edge labeling for the complete graph exists: for example, nodes i and j can use 
port number (i + j) mod n for the edge connecting them.. Consider two different sets of initial 
values, namely the vectors (i) x, and (ii) iTij(x). Let the port labeling in case (i) be arbitrary; 



in case (ii), let the port labeling be such that the conditions in Lemma 3.1 are satisfied (which is 
easily accomplished). Since the final value is f(x) in case (i) and /(^(x)) in case (ii), we obtain 
f(x) = f(7Tij(x)). Since the permutations 7r^ generate the group of permutations, permutation 
invar iance follows. □ 

Let x E X n . We will denote by x 2 the concatenation of x with itself, and, generally, by x k the 
concatenation of k copies of x. We now prove that self-concatenation does not affect the value of 
a computable family of functions. 

Lemma 3.3. Suppose that the family (f n )n=i,2.... is computable with infinite memory on edge- 
labeled networks. Then, for every n > 2, every sequence x G X n , and every positive integer m, 

fn(%) = fmn{x )• 

Proof. Consider a ring of n nodes, where the zth node clockwise begins with the ith element of x; 
and consider a ring of mn nodes, where the nodes i,i + n,i + 2n, . . . (clockwise) begin with the ith 
element of x. Suppose that the labels in the first ring are 0, 1, 2, 1,2,.. .. That is, the label of the 
edge (1, 2) is at both nodes 1 and 2; the label of a subsequent edge (i, i + 1) is the same at both 
nodes i and i + 1, and alternates between 1 and 2 as i increases. In the second ring, we simply 
repeat m times the labels in the first ring. See Figure [l] for an example with n = 5, m = 2. 
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Figure 1: Example of two situations that are algorithmically indistinguishable. The numbers next 
to each edge are the edge labels. 



Initially, the state Si(t) = [xi, yi{t), Zi(t), rrii^t), mj^i)], with t = 0, of node i in the first ring 
is exactly the same as the state of the nodes j = i, i + n, % + 2n, ... in the second ring. We show 
by induction that this property must hold at all times t. (To keep notation simple, we assume, 
without any real loss of generality, that i 7^ 1 and i 7^ n.) 

Indeed, suppose this property holds up to time t. At time t, node % in the first ring receives a 
message from node i — 1 and a message from node i + 1; and in the second ring, node j satisfying 
j (mod n) = i receives one message from j — 1 and j + 1. Since j — 1 (mod n) = i — 1 (mod n) and 
j + 1 (mod n) = i + l (mod n), the states of j — 1 and i — 1 are identical at time i, and similarly for 
j + 1 and i + 1. Thus, because of periodicity of the edge labels, nodes i (in the first ring) and j (in 
the second ring) receive identical messages through identically labeled ports at time t. Since i and 
j were in the same state at time t, they must be in the same state at time t + 1. This proves that 
they are always in the same state. It follows that y«(i) = Vj(t) for all t, whenever j (mod n) = i, 
and therefore f n (x) = f mn (x m ). □ 



Proof of Theorem \3.1\ Let x and y be two sequences of n and m elements, respectively, such that 
Pk(x±, ■ ■ ■ ,x n ) and Pk(yi, ■ ■ ■ ,y m ) are equal to a common value pk, for k £ X; thus, the number 
of occurrences of k in x and y are npk and mpk, respectively. Observe that for any k € X, the 
vectors x m and y n have the same number mn of elements, and both contain mnpk occurrences of 
k. The sequences y n and x m can thus be obtained from each other by a permutation, which by 



Lemma [3.2| implies that f n m(x m ) = fnm(y n )- From Lemma 3.3, we have that f n m(x m ) = f n (x) 
and fmn{y n ) = fmiy)- Therefore, f n (x) = f m (y)- This proves that the value of f n (x) is determined 
by the values of Pk(x\, ■ ■ ■ , x n ),k = 0,l,...,K. □ 

Remark: Observe that the above proof remains valid even under the "symmetry" assumption that 
an edge is assigned the same label by both of the nodes that it is incident on. port label of each 
edge is the same at every node. 

4 Reduction of generic functions to the computation of averages 

In this section, we turn to positive results, aiming at a converse of Theorem |3.1| The centerpiece of 



our development is Theorem 4.1, which states that a certain average-like function is computable. 



Theorem |4.1| then implies the computability of a large class of functions, yielding an approximate 



converse to Theorem 3.1 We will then illustrate these positive results on some examples. 
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The average-like functions that we consider correspond to the "interval consensus" problem 
studied in [7]. They are defined as follows. Let X = {0, . . . ,K}. Let Y be the following set of 
single-point sets and intervals: 

Y = {{0},(0,1),{1},(1,2),...,{K-1},(K-1,K),{K}} 

(or equivalently, an indexing of this finite collection of intervals). For any n, let f n be the function 
that maps (x\, X2, ■ ■ ■ , x n ) to the element of Y which contains the average ^ Xi/n. We refer to the 
function family (f n )n=\2 ... as the interval- averaging family. The output of this family of functions 
is thus the exact average when it is an integer; otherwise, it is the open interval between two integers 
that contains the average. 

The motivation for this function family comes from the fact that the exact average Xi /n 
takes values in a countably infinite set, and cannot be computed when the set Y is finite. In 
the quantized averaging problem considered in the literature, one settles for an approximation 
of the average. However, such approximations do not necessarily define a single-valued function 
from X n into Y. In contrast, the above defined function f n is both single- valued and delivers 
an approximation with an error of size at most one. Note also that once the interval-average is 
computed, we can readily determine the value of the average rounded down to an integer. 

Theorem 4.1. The interval- averaging function family is computable. 



The proof of Theorem 
veloped in Sections [5] and 



4.1 (and the corresponding algorithm) is quite involved; it will be de- 
In this section, we show that the computation of a broad class of 



functions can be reduced to interval-averaging. 

Since only frequency-based function families can be computable (Theorem 3.1), we can restrict 
attention to the corresponding functions h. We will say that a function h on the unit simplex D is 
computable if it corresponds to a frequency-based computable family (/ n )- The level sets of h are 
defined as the sets L(y) = {p G D \ h(p) = y}, for y £ Y. 

Theorem 4.2 (Sufficient condition for computability) . Let h be a function from the unit simplex 
DtoY. Suppose that every level set L(y) can be written as a finite union, 

L(y) = (jC hk , 

k 

where each Cj & can in turn be written as a finite intersection of linear inequalities of the form 

aopo + a\p\ + CK2P2 H Yct K p K <ct, (4.1) 

or 

aoPo + ct\p\ + a2P2 H 1- Q-kPk < ct, 

with rational coefficients a, ao, ai, • • • , olk- Then, h is computable. 
Proof. Consider one such linear inequality, which we assume, for concreteness, to be of the form 



(4.1). Let P be the set of indices k for which oik > 0. Since all coefficients are rational, we can 



clear their denominators and rewrite the inequality as 



- Yl fop* ^ ^ ( 4 - 2 ) 

fceP keP c 
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for nonnegative integers (3k and (3. Let Xk be the indicator function associated with initial value k, 

1 

n 



i.e., Xk(i) = 1 if Xi = k, and Xk(i) = otherwise, so that pk = - ^2iXk{i)- Then, (4.2) becomes 



n 

or 



i=l VfceP keP c J keP c 



1 n 

n ^ 

i=i 



'i < 



where qt = J2keP PkXk{i) + EfceP c PkO- ~ Xk(i)) and q* = f3 + EfceP c A- 

An algorithm that determines whether the last inequality is satisfied can be designed as follows. 
Knowing the parameters /3k and the set P, which can be made part of algorithm description as they 
depend on the problem and not on the data, each node can initially compute its value as well as 
the value of q* . Nodes can then apply the distributed algorithm that computes the integer part of 



- Ya=i Qi'i this is possible by virtue of Theorem 4.1 with K set to J2 k Pk (the largest possible value 



of (ft). It suffices then for them to constantly compare the current output of this algorithm to the 
integer q* . To check any finite collection of inequalities, the nodes can perform the computations 
for each inequality in parallel. 

To compute h, the nodes simply need to check which set L(y) the frequencies po,pi, ■ ■ ■ ,Pk he 
in, and this can be done by checking the inequalities defining each L{y). All of these computations 
can be accomplished with finite automata: indeed, we do nothing more than run finitely many 



copies of the automata provided by Theorem 4.1, one for each inequality. The total memory used 



by the automata depends on the number of sets and the magnitude of the coefficients /3k, but 
not on n, as required. □ 

Theorem |4.2| shows the computability of functions h whose level-sets can be defined by linear 
inequalities with rational coefficients. On the other hand, it is clear that not every function h can 
be computable. (This can be shown by a counting argument: there are uncountably many possible 
functions h on the rational elements of D, but for the special case of bounded degree graphs, 
only countably many possible algorithms.) Still, the next result shows that the set of computable 
functions is rich enough, in the sense that computable functions can approximate any measurable 
function, everywhere except possibly on a low- volume set. 

We will call a set of the form nfc=o( afc > ^ fc )> w ith every a^, bk rational, a rational open box, where 
Y[ stands for Cartesian product. A function that can be written as a finite sum X^ a «lPi> where 
the Bi are rational open boxes and the 1^ are the associated indicator functions, will be referred 
to as a box function. Note that box functions are computable by Theorem |4.2| 

Corollary 4.3. If every level set of a function h : D — )• Y on the unit simplex D is Lebesgue 
measurable, then, for every e > 0, there exists a computable box function h e : D — >• Y such that the 
set {p € D | h(p) 7^ h e (p)} has measure at most e. 

Proof. (Outline) The proof relies on the following elementary result from measure theory. Given 
a Lebesgue measurable set EC. D and some e > 0, there exists a set E' which is a finite union of 
disjoint open boxes, and which satisfies 

H(EAE') < e, 

where \x is the Lebesgue measure and A is the symmetric difference operator. By a routine ar- 
gument, these boxes can be taken to be rational. By applying this fact to the level sets of the 
function h (assumed measurable), the function h can be approximated by a box function h e . Since 
box functions are computable, the result follows. □ 
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The following corollary states that continuous functions are approximable. 



Corollary 4.4. If a function h : D — > [L, U] C K is continuous, then for every e > there 
exists a computable function h e : D—> [L, U] such that \\h — fo e ||oo < e 

Proof. Since D is compact, h is uniformly continuous. One can therefore partition D into a finite 
number of subsets, Ai,A2, ■ ■ ■ , A q , that can be described by linear inequalities with rational coeffi- 
cients, so that m&Xp^Aj h(p) — min pg ^ h(p) < e holds for all Aj, The function h e is then built by 
assigning to each Aj an appropriate value in {L, L + e, L + 2e, . . . , U}. □ 

To illustrate these results, let us consider again some examples, 
(a) Majority voting between two options is equivalent to checking whether p\ < 1/2, with alphabet 



{0, 1}. This condition is clearly of the form (4.1), and is therefore computable. 



(b) Majority voting when some nodes can "abstain" amounts to checking whether pi — po > 0, 
with input set X ={0, 1, abstain}. This function family is computable. 

(c) We can ask for the second most popular value out of four, for example. In this case, the sets 
Ai can be decomposed into constituent sets defined by inequalities such as p2 < Pz < Pi < Pi > 
each of which obviously has rational coefficients. The level sets of the function can thus clearly 



be expressed as unions of sets defined by a collection of linear inequalities of the type (4.1), 
so that the function is computable. 

(d) For any subsets /, I' of {0, 1, . . . , K}, the indicator function of the set where J2iei P* > Yliei' P i 
is computable. This is equivalent to checking whether more nodes have a value in / than do 
in I'. 

(e) The indicator functions of the sets defined by p\ < 1/2 and p\ < 7r/4 are measurable, so they 
are approximable. We are unable to say whether they are computable. 

(f ) The indicator function of the set defined by P1P2 < 1/8 is approximable, but we are unable to 
say whether it is computable. 

Finally, we show that with infinite memory, it is possible to recover the exact frequencies pk- 
(Note that this is impossible with finite memory, because n is unbounded, and the number of bits 
needed to represent pk is also unbounded.) The main difficulty is that pk is a rational number 
whose denominator can be arbitrarily large, depending on the unknown value of n. The idea is to 
run separate algorithms for each possible value of the denominator (which is possible with infinite 
memory), and reconcile their results. 

Theorem 4.5. The vector (po,Pi, ■ ■ ■ ,Pk) is computable with infinite memory. 

Proof. We show that pi is computable exactly, which is sufficient to prove the theorem. Consider 
the following algorithm, to be referred to as Q m , parametrized by a positive integer m. The input 
set X m is {0, 1, . . . ,m} and the output set Y m is the same as in the interval-averaging problem: 
Y m = {{0}, (0, 1), {1}, (1, 2), {2}, (2, 3), . . . , {m - 1}, (m - 1, m), {m}}. If Xi = 1, then node sets 
its initial value Xj jm to m; else, the node sets its initial value Xi )Tn to 0. The algorithm computes 
the function family (f n ) which maps to the element of Y m containing (1/n) Y17=i x i,m> which 
is possible, by Theorem |4.1| 

The nodes run the algorithms Q m for every positive integer value of m, in an interleaved manner. 
Namely, at each time step, a node runs one step of a particular algorithm Q m , according to the 
following order: 

Qi, Qi,Q2, Qi,Q2,Q3, Qi,Q2,Qs,Q4, Qi,Q2,- - 

At each time t, let mi(t) be the smallest m (if it exists) such that the output yi )T n(t) of Q m at 
node i is a singleton (not an interval). We identify this singleton with the numerical value of its 



12 



single element, and we set yi(t) = yi, mi (t)(t) /rrii(t) . If rrii(t) is undefined, then yiii) is set to some 
default value, e.g., 0. 



Let us fix a value of n. For any m < n, the definition of Q m and Theorem 4.1 imply that 
there exists a time after which the outputs yi t m of Q m do not change, and are equal to a common 
value, denoted y m , for every i. Moreover, at least one of the algorithms Q±, . . . ,Q n has an integer 
output y m . Indeed, observe that Q n computes (1/n) Y^i=i n ^xi=i = Y%=i la*=i> which is clearly 
an integer. In particular, mi(t) is eventually well-defined and bounded above by n. We conclude 
that there exists a time after which the output y%{t) of our overall algorithm is fixed, shared by all 
nodes, and different from the default value 0. 

We now argue that this value is indeed p\. Let m* be the smallest m for which the eventual 
output of Q m is a single integer y m . Note that y m * is the exact average of the Xi m *, i.e., 



1 ™ 

ym* = - Y] m*l Xi =i = m*p 1 . 

For large t, we have rriiit) = m* and therefore yiif) = yj,m,*(£)/ m * = V\i as desired. 

Finally, it remains to argue that the algorithm described here can be implemented with a 
sequence of infinite memory automata. All the above algorithm does is run a copy of all the 
automata implementing Qi,Q2, ■ ■ ■ with time-dependent transitions. This can be accomplished 
with an automaton whose state space is the countable set J\f x U^ =1 YYiLi Qii where Qi is the state 
space of Qi, and the set M of integers is used to keep track of time. □ 



5 Computing and tracking maximal values 

We now describe an algorithm that tracks the maximum (over all nodes) of time-varying inputs 
at each node. It will be used as a subroutine of the interval-averaging algorithm described in 
Section [6j and which is used to prove Theorem |4.1[ The basic idea is the same as for the simple 
algorithm for the detection problem given in Section [2| every node keeps track of the largest value 
it has heard so far, and forwards this "intermediate result" to its neighbors. However, when an 
input value changes, the existing intermediate results need to be invalidated, and this is done by 
sending "restart" messages. A complication arises because invalidated intermediate results might 
keep circulating in the network, always one step ahead of the restart messages. We deal with this 
difficulty by "slowing down" the intermediate results, so that they travel at half the speed of the 
restart messages. In this manner, restart messages are guaranteed to eventually catch up with and 
remove invalidated intermediate results. 

We start by giving the specifications of the algorithm. Suppose that each node i has a time- 
varying input Ui{t) stored in memory at time t, belonging to a finite set of numbers IA. We assume 
that, for each i, the sequence Ui(t) must eventually stop changing, i.e., that there exists some T" 
such that 

Ui(t) = Ui(T'), for all i and t > T' . 

(However, node i need not ever be aware that Ui(t) has reached its final value.) Our goal is to 
develop a distributed algorithm whose output eventually settles on the value maxjKj(T'). More 
precisely, each node i is to maintain a number Mi(t) which must satisfy the following condition: 
for every network and any allowed sequences Ui(t), there exists some T" with 

Mj(t) = max uj(t), for all i and t > T . 

j=l,...,n 
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Moreover, each node i must also maintain a pointer Pi(t) to a neighbor or to itself. We will use 
the notation Pf{t) = Pp.^(t), -Ff (i) = P P 2^(t), etc. We require the following additional property, 
for all t larger than T": for each node i there exists a node j and a power K such that for all k > K 
we have P^(t) = j and Mj(t) = Uj(t). In words, by successively following the pointers Pj(t), one 
can arrive at a node with a maximal value. 

We next describe the algorithm. We will use the term slot t to refer, loosely speaking, to the 
interval between times t and t + 1. More precisely, during slot t each node processes the messages 
that have arrived at time t and computes the state at time t + 1 as well as the messages it will send 
at time t + 1. 

The variables Mj(i) and P%(f) are a complete description of the state of node i at time t. 
Our algorithm has only two types of messages that a node can send to its neighbors. Both are 
broadcasts, in the sense that the node sends them to every neighbor: 

1. "Restart!" 

2. "My estimate of the maximum is y" where y is some number in U chosen by the node. 

Initially, each node sets M$(0) = Uj(0) and -Pj(O) = i. At time t = 0, 1, . . ., nodes exchange messages, 
which then determine their state at time t + 1, i.e., the pair Mj(t + l),Pi(t + 1), as well as the 
messages to be sent at time t+1. The procedure node z uses to do this is described in Figure [2j One 
can verify that a memory size of C log \U\ + C log d(i) at each node i suffices, where C is an absolute 
constant. (This is because Mj and Pi can take one of \U\ and d(i) possible values, respectively.) 

The result that follows asserts the correctness of the algorithm. The idea of the proof is quite 
simple. Nodes maintain estimates Mj(t) which track the largest among all the Ui(t) in the graph; 
these estimates are "slowly" forwarded by the nodes to their neighbors, with many artificial delays 
along the way. Should some value Uj{t) change, restart messages traveling without artificial delays 
are forwarded to any node which thought j had a maximal value, causing those nodes to start over. 
The possibility of cycling between restarts and forwards is avoided because restarts travel faster. 
Eventually, the variables Ui(t) stop changing, and the algorithm settles on the correct answer. On 
the other hand a formal and rigorous exposition of this simple argument is rather tedious. A formal 
proof is available in Appendix A. 

Theorem 5.1 (Correctness of the maximum tracking algorithm). Suppose that the Ui(t) stop 
changing after some finite time. Then, for every network, there is a time after which the variables 
Pi(t) and Mi(t) stop changing and satisfy Mj(t) = maxj Ui(t); furthermore, after that time, and for 
every i, the node j = P™(t) satisfies Mi(t) = Uj(t). 

6 Interval-averaging 

In this section, we present an interval-averaging algorithm and prove its correctness. We start with 
an informal discussion of the main idea. Imagine the integer input value X{ as represented by a 
number of Xi pebbles at node i. The algorithm attempts to exchange pebbles between nodes with 
unequal numbers so that the overall distribution becomes more even. Eventually, either all nodes 
will have the same number of pebbles, or some will have a certain number and others just one more. 
We let Ui(t) be the current number of pebbles at node i; in particular, itj(0) = Xj. An important 
property of the algorithm will be that the total number of pebbles is conserved. 

To match nodes with unequal number of pebbles, we use the maximum tracking algorithm of 
Section [5| Recall that the algorithm provides nodes with pointers which attempt to track the 
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-1) = largest value 




received 
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1) = a node that sent 




that value 



At time t+1, broadcast 

"restart" 

to all neighbors 



At time t+1, broadcast 
"my max is M( t)" 
to all neighbors 



At time t+1, broadcast 

"restart" 

to all neighbors 



At time t+1, broadcast 
"my max is M( t)" 
to all neighbors 



Figure 2: Flowchart of the procedure used by node i during slot t in the maximum tracking 
algorithm. The subscript i is omitted, but u(t), M[t), and P(t) should be understood as Ui(t), 
Mj(t), and Pi(t). In those cases where an updated value of M or P is not indicated, it is assumed 
that M(t + 1) = M(t) and P(t + 1) = P(t). The symbol is used to indicate no action. Note 
that the various actions indicated are taken during slot t, but the messages determined by these 
actions are sent (and instantaneously received) at time t + 1. Finally, observe that every node 
sends an identical message to all its neighbors at every time t > 0. We note that the apparent 
non-determinism in instruction 02 can be removed by picking a node with, say, the smallest port 
label. 



location of the maximal values. When a node with m pebbles comes to believe in this way that 
a node with at least ui + 2 pebbles exists, it sends a request in the direction of the latter node 
to obtain one or more pebbles. This request follows a path to a node with a maximal number of 
pebbles until the request either gets denied, or gets accepted by a node with at least ui + 2 pebbles. 

6.1 The algorithm 

The algorithm uses two types of messages. Each type of message can be either originated at a node 
or forwarded by a node. 

(a) (Request, r): This is a request for a transfer of pebbles. Here, r is an integer that represents 
the number of pebbles Ui(t) at the node i that first originated the request, at the time t that 
the request was originated. (Note, however, that this request is actually sent at time t + 1.) 

(b) (Accept, w): This corresponds to acceptance of a request, and a transfer of w pebbles towards 
the node that originated the request. An acceptance with a value w = represents a request 
denial. 

As part of the algorithm, the nodes run the maximum tracking algorithm of Section [5j as well 
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as a minimum tracking counterpart. In particular, each node i has access to the variables Mj(t) 
and Pi(t) of the maximum tracking algorithm (recall that these are, respectively, the estimated 
maximum and a pointer to a neighbor or to itself). Furthermore, each node maintains three 
additional variables. 

(a) "Mode(i)"G {Free, Blocked}. Initially, the mode of every node is free. A node is blocked if 
it has originated or forwarded a request, and is still waiting to hear whether the request is 
accepted (or denied). 

(b) "Rim(f)" and "Routj(i)" are pointers to a neighbor of i, or to i itself. The meaning of these 
pointers when in blocked mode are as follows. If Routj(t) = j, then node i has sent (either 
originated or forwarded) a request to node j, and is still in blocked mode, waiting to hear 
whether the request is acceptd or denied. If Rinj(t) = k, and k ^ i, then node i has received 
a request from node k but has not yet responded to node k. If Rhij(i) = i, then node i 
has originated a request and is still in blocked mode, waiting to hear whether the request is 
accepted or denied. 

A precise description of the algorithm is given in Figure [3| The proof of correctness is given in 
the next subsection, thus also establishing Theorem 4.1. Furthermore, we will show that the time 
until the algorithm settles on the correct output is of order 0(n 2 K 2 ). 



6.2 Proof of correctness 

We begin by arguing that that the rules of the algorithm preclude one potential obstacle; we will 
show that nodes will not get stuck sending requests to themselves. 

Lemma 6.1. A node never sends (originates or forwards) a request to itself. More precisely, 
Routi(t) 7^ i, for all i and t. 

Proof. By inspecting the first two cases for the free mode, we observe that if node i originates a 
request during time slot t (and sends a request message at time t + 1), then Pi(t) ^ i. Indeed, to 
send a message, it must be true Mi(t) > Ui(t) = Ui(t — 1). However, any action of the maximum 
tracking algorithm that sets Pi(t) = i also sets Mi(t) = m(t — 1), and moreover, as long as P, 
doesn't change neither does M,. So the recipient Pi(t) of the request originated by % is different 
than i, and accordingly, Routj(t + 1) is set to a value different than i. We argue that the same is 
true for the case where Routj is set by the the "Forward request" box of the free mode. Indeed, that 
box is enabled only when Ui(t) = Ui(t — 1) and Ui(t) — 1 < r < Mi(t) — 1, so that U{(t — 1) < Mi(t). 
As in the previous case, this implies that Piit) ^ i and that Routj(i + 1) is again set to a value 
other than i. We conclude that Routj(t) ^ % for all i and t. □ 

We will now analyze the evolution of the requests. A request is originated at some time r 
by some originator node £ who sets Rin^(r + 1) = I and sends the request to some node % = 
Rout£(T + 1) = Pi(t). The recipient i of the request either accepts/denies it, in which case Rinj 
remains unchanged, or forwards it while also setting Rim,(r + 2) to I. The process then continues 
similarly. The end result is that at any given time t, a request initiated by node £ has resulted 
in a "request path of node i at time t," which is a maximal sequence of nodes £, i\, . . . ,ik with 
Rmi(t) = £, Rinj^t) = £, and Rinj m (t) = i m -l for m < k. 

Lemma 6.2. At any given time, different request paths cannot intersect (they involve disjoint 
sets of nodes). Furthermore, at any given time, a request path cannot visit the same node more 
than once. 
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Is u(t) = ? 



Deny all incoming requests 



-yes 



Is M[t) - u(t) > 2 ' 



yes 



Any incoming 
request? 



yes 



r := smallest of the request values 

k := a node that sent request with value r 



Originate request: 
Send (Request, u(t)) to P[t) 
Mode{t+l) = Blocked 
Rout(t+l) = P(t) 
Rin(t+1) = i 



Free mode 




Accept request: 
w= Y{u{t)-r)/2\ 
u{t+l) = u(t) - w 
Send (Accept, w) to k 



Forward request: 
Send (Request, r) to P(t) 
Mode(t+l) = Blocked 
Rout(t+l) = P(t) 
Rin{t+1) = k 



Deny the request of k 



Deny all incoming requests 




Blocked mode 



Fulfill the acceptance: 
u(t+l) = u(t) + w 
Mode(t+l) = Free 



Forward the acceptance: 
Forward (Accept, w) to Rin(t) 
Mode(m) = Free 



Figure 3: Flowchart of the procedure used by node i during slot t in the interval-averaging algorithm. 
The subscript i is omitted from variables such as Mode(t), M(t), etc. Variables for which an update 
is not explicitly indicated are assumed to remain unchanged. "Denying a request" is a shorthand 
for i sending a message of the form (Accept, 0) at time t + 1 to a node from which i received a 
request at time t. Note also that "forward the acceptance" in the blocked mode includes the case 
where the answer had w = (i.e., it was a request denial), in which case the denial is forwarded. 
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Proof. For any time t, we form a graph that consists of all edges that lie on some request path. 
Once a node i is added to some request path, and as long as that request path includes i, node i 
remains in blocked mode and the value of Rinj cannot change. This means that adding a new edge 
that points into i is impossible. This readily implies that cycles cannot be formed and also that 
two request paths cannot involve a common node. □ 

We use pi(t) to denote the request path of node i at time t, and se(t) to denote the last node 
on this path. We will say that a request originated by node £ terminates when node i receives an 
(Accept, w) message, with any value w. 

Lemma 6.3. Every request eventually terminates. Specifically, if node t originates a request 
at time t' ( and sends a request message at time t' + 1 ), then there exists a later time t" <t' + n at 
which node s r {t") receives an "accept request" message (perhaps with w = 0), which is forwarded 
until it reaches I, no later than time t" + n. 

Proof. By the rules of our algorithm, node i sends a request message to node Pe(t') at time t! + 1. 
If node Pi(t') replies at time t' + 2 with a "deny request" response to ts request, then the claim 
is true; otherwise, observe that pi(t' + 2) is nonempty and until si(t) receives an "accept request" 
message, the length of pt{t) increases at each time step. Since this length cannot be larger than 



n—1, by Lemma 6.2 it follows that se(t) receives an "accept request" message at most n steps 
after £ initiated the request. One can then easily show that this acceptance message is forwarded 
backwards along the path (and the request path keeps shrinking) until the acceptance message 
reaches £, at most n steps later. □ 

The arguments so far had mostly to do with deadlock avoidance. The next lemma concerns 
the progress made by the algorithm. Recall that a central idea of the algorithm is to conserve the 
total number of "pebbles," but this must include both pebbles possessed by nodes and pebbles in 
transit. We capture the idea of "pebbles in transit" by defining a new variable. If i is the originator 
of some request path that is present at time i, and if the final node Si(t) of that path receives 
an (Accept, w) message at time t, we let u>i(t) be the value w in that message. (This convention 
includes the special case where w = 0, corresponding to a denial of the request). In all other cases, 
we set uii{t) = 0. Intuitively, Wi{t) is the value that has already been given away by a node who 
answered a request originated by node i, and that will eventually be added to Ui, once the answer 
reaches i. 

We now define 

Ui(t) = Ui(t) + Wi(t). 

By the rules of our algorithm, if Wi(t)= w > 0, an amount w will eventually be added to Uj, once 
the acceptance message is forwarded back to i. The value Ui can thus be seen as a future value of 
Ui, that includes its present value and the value that has been sent to i but has not yet reached it. 

The rules of our algorithm imply that the sum of the Ui remain constant. Let x be the average 
of the initial values Xi. Then, 



// * n ' 

i=l i=l 



^ n 1 

-E^) = -E 

We define the variance function V as 

n 

V(t) = X>(*) 



x) 2 . 



i=i 
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Lemma 6.4. The number of times that a node can send an acceptance message (Accept, w) 
with w 7^ 0, is finite. 

Proof. Let us first describe the idea behind the proof. Suppose that nodes could instantaneously 
transfer value to each other. It is easily checked that if a node i transfers an amount w* to a node 
j with Ui — Uj>2 and 1 < w* < \(ui — Uj), the variance J2i( u i ~ decreases by at least 2. Thus, 
there can only be a finite number of such transfers. In our model, the situation is more complicated 
because transfers are not immediate and involve a process of requests and acceptances. A key 
element of the argument is to realize that the algorithm can be interpreted as if it only involved 
instantaneous exchanges involving disjoint pairs of nodes. 

Let us consider the difference V(t + 1) — V(t) at some typical time t. Changes in V are solely 
due to changes in the Uj. Note that if a node i executes the "fulfill the acceptance" instruction 
at time t, node i was the originator of the request and the request path has length zero, so that 
it is also the final node on the path, and Sj(i) = i. According to our definition, Wi(t) is the value 
w in the message received by node Si(t) = i. At the next time step, we have Wi(t + 1) =0 but 
Ui(t + 1) = Ui{t) + w. Thus, Ui does not change, and the function V is unaffected. 

By inspecting the algorithm, we see that a nonzero difference V(t + 1) — V(t) is possible only if 
some node i executes the "accept request" instruction at slot t, with some particular value w*^ 0, 
in which case Ui(t + 1) = Ui(t) — w*. For this to happen, node i received a message (Request, r) 
at time t from a node k for which Routfc(i) = i, and with Ui{t) — r > 2. That node k was the 
last node, se(t), on the request path of some originator node £. Node k receives an (Accept, w*) 
message at time t + 1 and, therefore, according to our definition, this sets w^{t + 1) = w*. 

It follows from the rules of our algorithm that I had originated a request with value r = U((t f ) at 
some previous time t' . Subsequently, node I entered the blocked mode, preventing any modification 
of U£, so that r = u^{t) = un{t + l). Moreover, observe that wi(t) was because by time t, no node 
had answered £'s request. Furthermore, Wi{t + 1) = Wi(t) = because having a positive Wi requires 
i to be in blocked mode, preventing the execution of "accept request" . It follows that 

Ui(t + 1) = Ui(t + 1) = Ui{t) - W* = Ui(t) - w*, 

and 

Ui(t + 1) = r + w* = ue(t) + w* . 
Using the update equation w* = [(ui(t) — r)/2j , and the fact Ui{t) — r > 2, we obtain 

1 < w* < ±(ui(t) -r) = ±(ui(t) - u e (t)). 

Combining with the previous equalities, we have 

ue(t) + 1 < ue(t + 1) < Ui(t + 1) < Ui{t) - 1. 

Assume for a moment that node i was the only one that executed the "accept request" instruction at 
time t. Then, all of the variables Uj, for j / i, £, remain unchanged. Simple algebraic manipulations 
then show that V decreases by at least 2. If there was another pair of nodes, say j and k, that 
were involved in a transfer of value at time t, it is not hard to see that the transfer of value was 
related to a different request, involving a separate request path. In particular, the pairs £, i and 
j, k do not overlap. This implies that the cumulative effect of multiple transfers on the difference 
V(t + 1) — V(t) is the sum of the effects of individual transfers. Thus, at every time for which at 
least one "accept request" step is executed, V decreases by at least 2. We also see that no operation 
can ever result in an increase of V. It follows that the instruction "accept request" can be executed 
only a finite number of times. □ 
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Proposition 6.1. There is a time t' such that u»(f) = Ui(t'), for all i and all t > t' . Moreover, 

i i 

maxitj(i') — minwj(t') < 1. 



Proof. It follows from Lemma 6.4 that there is a time i' after which no more requests are accepted 
with By Lemma 6.3, this implies that after at most n additional time steps, the system will 

never again contain any "accept request" messages with ro / 0, so no node will change its value 
Ui(t) thereafter. 

We have already argued that the sum (and therefore the average) of the variables Ui(t) does 
not change. Once there are no more "accept request" messages in the system with w ^ 0, we must 
have Wi(t) = 0, for all i. Thus, at this stage the average of the Ui(t) is the same as the average of 
the Xi. 

It remains to show that once the Ui(t) stop changing, the maximum and minimum Ui(t) differ 



by at most 1. Recall (cf. Theorem that 5.1) that at some time after the itj(t) stop changing, all 
estimates Mj(t) of the maximum will be equal to M(i), the true maximum of the Ui(t); moreover, 
starting at any node and following the pointers Pi (t) leads to a node j whose value Uj (t) is the true 
maximum, M(t). Now let A be the set of nodes whose value at this stage is at most maxj Ui{t) — 2. 
To derive a contradiction, let us suppose that A is nonempty. 

Because only nodes in A will originate requests, and because every request eventually terminates 



(cf. Lemma 6.3), if we wait some finite amount of time, we will have the additional property that 
all requests in the system originated from A. Moreover, nodes in A originate requests every time 
they are in the free mode, which is infinitely often. 

Consider now a request originating at a node in the set A. The value r of such a request satisfies 
M(t) — r > 2, which implies that every node that receives it either accepts it (contradicting the 
fact that no more requests are accepted after time t'), or forwards it, or denies it. But a node i will 
deny a request only if it is in blocked mode, that is, if it has already forwarded some other request 
to node Pi(t). This shows that requests will keep propagating along links of the form (i, Pj(t)), and 
therefore will eventually reach a node at which u%(t) = M(t) > r + 2, at which point they will be 
accepted — a contradiction. □ 

We are now ready to conclude. 



Proof of Theorem 4-1 Let u* be the value that Ui(t) eventually settles on. Proposition 6.1 readily 
implies that if the average x of the Xi is an integer, then Ui(t) = u* = x will eventually hold for 
every i. If x is not an integer, then some nodes will eventually have Ui(t) = u* = [x\ and some 
other nodes Uj(i) = u* = \x~\. Besides, using the maximum and minimum computation algorithm, 
nodes will eventually have a correct estimate of max u* and min u* , since all Ui (t) settle on the fixed 
values it*. This allows the nodes to determine whether the average is exactly u* (integer average), 
or whether it lies in (u*,u* + 1) or (it* — l,it*) (fractional average). Thus, with some simple post- 
processing at each node (which can be done using finite automata), the nodes can produce the 



correct output for the interval-averaging problem. The proof of Theorem 4.1 is complete. □ 



Next, we give a convergence time bound for the algorithms we have just described. 



Theorem 6.1. Any function h satisfying the assumptions of Theorem can be computed in 
0{n 2 K 2 ) time steps. 
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Figure 4: The number of iterations as a function Figure 5: The number of iterations as a function 
of the number of nodes for a complete graph under of the number of nodes for a line graph under 
random initial conditions. random initial conditions. 

Theorem 6.2. The functions h e whose existence is guaranteed by Corollary \4-3\ or Corollary 



4-4 can be computed in time which grows quadratically in n. 



The general idea behind Theorems 6.1 and 6.2 is quite simple. We have just argued that the 



nonnegative function V(t) decreases by at least 2 each time a request is accepted. It also satisfies 
V(0) = 0(nK 2 ). Thus there are at most 0(nK 2 ) acceptances. To prove Theorems 6.1 and 6.2 



is, 



one needs to argue that if the algorithm has not terminated, there will be an acceptance within 



0{n) time steps. This should be fairly clear from the proof of Theorem 4.1 A formal argument 
is given in Appendix B. It is also shown there that the running time of our algorithm, for many 
graphs, satisfies a Sl(n 2 ) lower bound, in the worst case over all initial conditions. 

7 Simulations 

We report here on simulations involving our algorithm on several natural graphs. Figures [4] and 
[5] describe the results for a complete graph and a line. Initial conditions were random integers 
between 1 and 30, and each data point represents the average of two hundred runs. As expected, 
convergence is faster on the complete graph. Moreover, convergence time in both simulations 
appears to be approximately linear. 

Finally recall that it is possible for our algorithm to take on the order of n 2 (as opposed to 0(n)) 
time steps to converge. Figure [6] shows simulation results for the dumbbell graph (two complete 
graphs with n/3 nodes, connected by a line) of length n/3; each node in one of the complete graphs 
starts with Xj(0) = 1, every node in the other complete graph starts with Xj(0) = 30. The time to 
converge in this case is quadratic in n. 



8 Conclusions 

We have proposed a model of deterministic anonymous distributed computation, inspired by the 
wireless sensor network and multi-agent control literature. We have given an almost tight char- 
acterization of the functions that are computable in our model. We have shown that computable 
functions must depend only on the the frequencies with which the different initial conditions appear, 
and that if this dependence can be expressed in term of linear inequalities with rational coefficients, 
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Figure 6: The number of iterations as a function of the number of nodes for a dumbbell graph. 

the function is indeed computable. Under weaker conditions, the function can be approximated 
with arbitrary precision. It remains open to exactly characterize the class of computable function 
families. 

Our positive results are proved constructively, by providing a generic algorithm for computing 
the desired functions. Interestingly, the finite memory requirement is not used in our negative 
results, which remain thus valid in the infinite memory case. In particular, we have no examples of 
functions that can be computed with infinite memory but are provably not computable with finite 
memory. We suspect though that simple examples exist; a good candidate could be the indicator 
function lp 1 <i/ 7r , which checks whether the fraction of nodes with a particular initial condition is 
smaller than 1/tt. 

We have shown that our generic algorithms terminate in 0(n 2 ) time. On the other hand, it 
is clear that the termination time cannot be faster than the graph diameter, which is of order n, 
in the worst case. Some problems, such as the detection problem described in Section [2j admit 
0(n) algorithms. On the other hand, it is an open problem whether the interval averaging problem 
admits an o(n 2 ) algorithm under our model. Finally, we conjecture that the dependence on K in 
our 0(n 2 K 2 ) complexity estimate can be improved by designing a different algorithm. 

Possible extensions of this work involve variations of the model of computation. For example, 
the algorithm for detection problem, described in Section [2j does not make full use of the flexibility 
allowed by our model of computation. In particular, for any given i, the messages mij(t) are 
the same for all j, so, in some sense, messages are "broadcast" as opposed to being personalized 
for the different outgoing links. This raises an interesting question: do there exist computable 
function families that become non-computable when we restrict to algorithms that are limited to 
broadcast messages? We have reasons to believe that in a pure broadcast scenario where nodes 
located in a non-bidirectional network broadcast messages without knowing their out-degree (i.e., 
the size of their audience) , the only computable functions are those which test whether there exists 
a node whose initial condition belongs to a given subset of {0, 1, . . . , K}, and combinations of such 
functions. 

Another important direction is to consider models in which the underlying graph may vary 
with time. It is of interest to develop algorithms that converge to the correct answer at least when 
the underlying graph eventually stops changing. For the case where the graph keeps changing 
while maintaining some degree of connectivity, we conjecture that no deterministic algorithm with 
bounded memory can solve the interval-averaging problem. Finally, other extensions involve models 
accounting for clock asynchronism, delays in message propagation, or data loss. 
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A Proof of Theorem 



5.1 



In the following, we will occasionally use the following convenient shorthand: we will say that a 
statement S(t) holds eventually if there exists some T so that S(t) is true for all t >T. 

The analysis is made easier by introducing the time- varying directed graph G(t) = ({1, . . . , n},E(t)) 
where G E(t) if i ^ j, P%{t) = j, and there is no "restart" message sent by j (and therefore 
received by i) during time t. We will abuse notation by writing G G(t) to mean that the edge 
belongs to the set of edges E(t) at time n. 

Lemma A.l. Suppose that ^ G(t— 1) and G G(t). Then, i executes 02 during slot 
t-1. 

Proof. Suppose that £ G(t - 1) and G G(t). If Pi(t - 1) = j, the definition of G(t - 1) 
implies that j sent a restart message to i at time t — 1. Moreover, i cannot execute 03 during the 
time slot t — 1 as this would require Pi{t — 1) = i. Therefore, during this time slot, node i either 
executes 02 (and we are don^J or it executes one of 01 and 04a. For both of the latter two cases, 
we will have Pi(t) = i, so that will not be in G(t), a contradiction. Thus, it must be that 
Pi(t — 1) j. We now observe that the only place in Figure [2] that can change P{(t — 1)^ j to 
Pi(t) = j is 02. □ 

Lemma A. 2. In each of the following three cases, node i has no incoming edges in either graph 
G(t) orG(t+l): 

(a) Node i executes 01, 02, or 04a during time slot t — 1; 

(b) M^^M^t-l); 

(c) For some j, (i,j) G G(t) but (i,j) £ G(t - 1). 

Proof, (a) If i executes 01, 02, or 04a during slot t — 1, then it sends a restart message to each 
of its neighbors at time t. Then, for any neighbor j of i, the definition of G(t) implies that (j, i) 



is not in G(t). Moreover, by Lemma A.l in order for to be in G(t + 1), node j must execute 
02 during slot t. But the execution of 02 during slot t cannot result in the addition of the edge 
(j, i) at time t + 1, because the message broadcast by i at time t to its neighbors was a restart. So, 
(j,i)$G(t + l). 

(b) If Mi(t) 7^ Mi(t — 1), then i executes 01, 02, or 04a during slot t — 1, so the claim follows 
from part (a). 



(c) By Lemma A.l it must be the case that node i executes 02 during slot t — 1, and part (a) 



implies the result. □ 

Lemma A. 3. The graph G(t) is acyclic, for all t. 

Proof. The initial graph G(0) does not contain a cycle. Let t be the first time a cycle is present, 
and let be an edge in a cycle that is added at time t, i.e., belongs to G(t) but not 

G(t — 1). Lemma A.2[ c) implies that i has no incoming edges in G(t), so (i,j) cannot be an edge 



of the cycle — a contradiction. □ 

Note that every node has out-degree at most one, because Pi(t) is a single- valued variable. Thus, 
the acyclic graph G(t) must be a forest, specifically, a collection of disjoint trees, with all arcs of a 
tree directed so that they point towards a root of the tree (i.e., a node with zero out-degree). The 
next lemma establishes that Mi is constant on any path of G(t). 

Lemma A.4. If(i,j) G G(t), then M f (t) = Mj(t). 



1 In fact, it can be shown that this case never occurs. 
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Proof. Let t! be a time when is added to the graph, or more precisely, a time such that 

£ G(t') but (i,j) ^ G(t' — 1). First, we argue that the statement we want to prove holds at time 



t' . Indeed, Lemma A.l implies that during slot t'—l, node i executed 02, so that Mj(i') = Mj(t'-l) 



Moreover, Mj(tf — 1) = Mj(tf), because otherwise case (b) in Lemma A. 2 would imply that j has 
no incoming edges at time t' , contradicting our assumption that £ G(t'). 

Next, we argue that the property Mi(t) = Mj(t) continues to hold, starting from time t! and 
for as long as € G(t). Indeed, as long as 6 G(t), then Mj(t) remains unchanged, by 



case (b) of Lemma A. 2 To argue that Mj(i) also remains unchanged, we simply observe that in 
Figure [TJ every box which leads to a change in Mj also sets Pi either to i or to the sender of a 
message with value strictly larger than Mf, this latter message cannot come from j because as we 
just argued, increases in Mj lead to removal of the edge from G(t). So, changes in Mi are also 
accompanied by removal of the edge from G(t). □ 

For the purposes of the next lemma, we use the convention Ui(— 1) = Ui(0). 

Lemma A. 5. If Pi(t) = i, then Mj(t) = Ui(t - 1); if Pi(t) / i, then M*(t) > Uj(i-l). 

Proof. We prove this result by induction. Because of the convention Ui(— 1) = tti(O), and the 
initialization -Pj(O) = i, Mj(0) = tfj(O), the result trivially holds at time t = 0. Suppose now that 
the result holds at time t. During time slot t, we have three possibilities for node i: 

(i) Node i executes 01 or 04a. In this case, Mj(i + 1) = Ui(i),Pi(t + 1) = i, so the result holds 
at time t + 1. 

(ii) Node i executes 02. In this case Pi(t) / % and Mi(t + 1) > Mi(t) > Ui(t - 1) = Ui(t). The 
first inequality follows from the condition for entering step 02. The second follows from the 
induction hypothesis. The last equality follows because if Ui(t) ^ Ui{t — 1), node i would have 
executed 01 rather than 02. So, once again, the result holds at time t + 1. 

(iii) Node i executes 03 or 04b. The result holds at time t + 1 because neither nor Mj changes. 

□ 

In the sequel, we will use T" to refer to a time after which all the Ui are constant. The following 
lemma shows that, after T', the largest estimate does not increase. 

Lemma A. 6. Suppose that at some time tf > T' we have M > maxj Mj(t'). Then 

M>maxMj(t) (A. 3) 

i 

for all t>t'. 



Proof. We prove Eq. (A. 3) by induction. By assumption it holds at time t = t' . Suppose now Eq. 
(A.3) holds at time t; we will show that it holds at time t + 1. 

Consider a node i. If it executes 02 during the slot t, it sets Mj(t+ 1) to the value contained in 
a message sent at time t by some node j . It follows from the rules of our algorithm that the value 
in this message is Mj(t) and therefore, Mi(t + 1) = Mj(t) < M. 

Any operation other than 02 that modifies Mj sets Mj(t + 1) = m(t), and since Ui(t) does not 
change after time T' , we have Mj(i + 1) = iii(t — 1). By Lemma |A.5 Mj(t) > Ui(t — 1), so that 



Mj(i + 1) < Mi(t). We conclude that Mj(t + 1) < M holds for this case as well. □ 
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We now introduce some terminology used to specify whether the estimate Mi(t) held by a node 
has been invalidated or not. Formally, we say that node i has a valid estimate at time t if by 
following the path in G(t) that starts at i, we eventually arrive at a node r with P r (t) = r and 
Mi{t) = u r (t — 1). In any other case, we say that a node has an invalid estimate at time t. 

Remark: Because of the acyclicity property, a path in G(t), starting from a node i, eventually 



leads to a node r with out-degree 0; it follows from Lemma A.4| that M r (t) = M{(t). Moreover 



Lemma A. 5 implies that if P r (t) = r, then Mi(t) = M r {t) = u r (t — 1), so that the estimate is 
valid. Therefore, if i has an invalid estimate, the corresponding node r must have P r (t) ^ r; on the 
other hand, since r has out-degree in G(t), the definition of G(t) implies that there is a "restart" 
message from P r (t) to r sent at time t. 

The following lemma gives some conditions which allow us to conclude that a given node has 
reached a final state. 

Lemma A. 7. Fix some t! > T' and let M* be the largest estimate at time t! , i.e., M* = 
maxj Mi(t'). If Mi(t') = M* , and this estimate is valid, then for all t > t' : 

(a) Mi(t) = M* , Pi(t) = Pi(t'), and node i has a valid estimate at time t. 

(b) Node i executes either 03 or 04b at time t. 

Proof. We will prove this result by induction on t. Fix some node i. By assumption, part (a) holds 
at time t = t'. To show part (b) at time t = tf, we first argue that i does not execute 02 during 
the time slot t. Indeed, this would require i to have received a message with an estimate strictly 
larger than M*, sent by some node j who executed 03 or 04b during the slot t — 1. In either 
case, M* < Mj(t — 1) = Mj(t), contradicting the definition of M* . Because of the definition of T', 
Ui(t) = Ui(t — 1) for t > T', so that i does not execute 01. This concludes the proof of the base 
case. 

Next, we suppose that our result holds at time t, and we will argue that it holds at time t + 1. 
If p^t) = i, then i executes 03 during slot t, so that Af*(t + 1) = Mj(t) and Pi(t + 1) = Pi(t), 
completes the induction step for this case. 

It remains to consider the case where P%(t) = j ^ i. It follows from the definition of a valid 
estimate that (i,j) S E(t). Using the definition of E(t), we conclude that there is no restart message 
sent from j to i at time t. By the induction hypothesis, during the slot t — 1, j has thus executed 



03 or 04b, so that Mj(t - 1) = Mj(t); in fact, Lemma [Ag] gives that Mj(t) = Mj(t) = M* . 
Thus during slot t, i reads a message from j = Pi(t) with the estimate M* , and executes 04b, 
consequently leaving its Mj or Pj unchanged. 

We finally argue that node z's estimate remains valid. This is the case because since we can 
apply the arguments of the previous paragraph to every node j on the path from i to a node with 
out-degree 0; we obtain that all of these nodes both (i) keep Pj(t + 1) = Pj(t) and (ii) execute 03 
or 04b, and consequently do not send out any restart messages. □ 



Recall (see the comments following Lemma A. 3) that G(t) consists of a collection of disjoint in 



trees (trees in which all edges are oriented towards a root node). Furthermore, by Lemma A. 4 the 
value of Mj(t) is constant on each of these trees. Finally, all nodes on a particular tree have either a 
valid or invalid estimate (the estimate being valid if and only if P r (t) = r and M r (t) = u r {t — 1) at 
the root node r of the tree.) For any z G U, we let G z (t) be the subgraph of G(t) consisting of those 
trees at which all nodes have Mi(t) = z and for which the estimate z on that tree is invalid. We refer 
to G z (t) as the invalidity graph of z at time t. In the sequel we will say that i is in G z (t), and abuse 
notation by writing i £ G z (t), to mean that i belongs to the set of nodes of G z {t). The lemmas 
that follow aim at showing that the invalidity graph of the largest estimate eventually becomes 
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empty. Loosely speaking, the first lemma asserts that after the Ui(t) have stopped changing, it 
takes essentially two time steps for a maximal estimate M* to propagate to a neighboring node. 

Lemma A. 8. Fix some time t > T' . Let M* be the largest estimate at that time, i.e., M* = 
maxj Mi(t). Suppose that i is in Gm*(t + 2) but not in GM*(t). Then P^(t + 2) G Gm*(£). 

Proof. The fact that i G M *(t) implies that either (i) Mj(t) / M* or (ii) Mi{t) = M* and % has 
a valid estimate at time t. In the latter case, it follows from Lemma |A.7| that i also has a valid 
estimate at time t + 2, contradicting the assumption i G Gjy/*(t + 2). Therefore, we can and will 
assume that Mj(t) < M*. Since t > T' , no node ever executes 01. The difference between Mj(t) 
and M{(t + 2) = M* can only result from the execution of 02 or 04a by i during time slot t or 
t + 1. 

Node i cannot have executed 04a during slot t + because this would result in Pj(t + 2) = i, 
and i would have a valid estimate at time t + 2, contradicting the assumption i G G* M (t + 2). 
Similarly, if i executes 04a during slot t it sets Pi(t + 1) = i. Unless it executes 02 during slot 
t + 1, we have again Pi(t + 2) = i contradicting the assumption i £ G* M (t + 2). Therefore, i must 
have executed 02 during either slot t + 1 or slot t, and in the latter case it must not have executed 
04a during slot t + 1. 

Let us suppose that i executes 02 during slot t + 1, and sets thus Pi(t + 2) = j for some j 
that sent at time t + 1 a message with the estimate M* = Mj(t + 2). The rules of the algorithm 
imply that M* = Mj(t + 1). We can also conclude that Mj(t + 1) = Mj(t), since if this were 
not true, node j would have sent out a restart at time t + 1. Thus Mj(t) = M* . It remains to 
prove that the estimate M* of j at time t is not valid. Suppose, to obtain a contradiction, that 



it is valid. Then it follows from Lemma A. 7 that j also has a valid estimate at time t + 2, and 
from the definition of validity that the estimate of i is also valid at t + 2, in contradiction with the 
assumption i G GM*(t + 2). Thus we have established that Pj(t + 2) = j G GM*(t) if i executes 
02 during slot t + 1. The same argument applies if i executes 02 during slot t, without executing 
04a or 02 during the slot t + 1, using the fact that in this case Pj(t + 2) = Pi{t + 1). □ 

Loosely speaking, the next lemma asserts that the removal of an invalid maximal estimate M* , 
through the propagation of restarts, takes place at unit speed. 

Lemma A. 9. Fix some time t > T' , and let M* be the largest estimate at that time. Suppose 
that i is a root (i.e., has zero out-degree) in the forest GM*{t + 2). Then, either (i) i is the root 
of an one-element tree in GM*(t + 2) consisting only of i, or (ii) i is at least "two levels down in 
Gjvf*(t), i.e., there exist nodes i',i" with (i,i'), (i' ,i") £ GM*(f)- 

Proof. Consider such a node i and assume that (i) does not hold. Then, 

Mi{t) = Mi(t + 1) = M;(t + 2) = M* 

Pi(t) = P(t + 1) = P(t + 2) (A.4) 



This is because otherwise, cases (a) and (b) of Lemma A. 2 imply that i has zero in-degree in 
GM*(t + 2) C G{t + 2), in addition to having a zero out-degree, contradicting our assumption that 
(i) does not hold. Moreover, the estimate of i is not valid at t, because it would then also be valid 



at t + 2 by Lemma A. 7 in contradiction with i G GM*{t + 2). Therefore, i belongs to the forest 
Gm* (t). Let r be the root of the connected component to which i belongs. We will prove that i/r 
and Pi(t) ^ r, and thus that (ii) holds. 

Since r G Gj\/*(t), we have M r {t) = M* and thus r does thus not execute 02 during slot t. 
Moreover, r is a root and has an invalid estimate, so P r (t) ^ r and there is a "restart" message 
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from P r (t) to r at time t. Therefore, r executes 04a during slot t, setting P r (t + 1) = r and sending 
"restart" messages to all its neighbors at time t + 1. This implies that i 7^ r, as we have seen that 
Pi(t) = Pi(t + 1). Let us now assume, to obtain a contradiction, that P%{t) = r and thus by Eq. 
( |A.4 ), Pi(t + 2) = Pi(t+i) = r. In that case, we have just seen that there is at time t+1 a "restart" 



message from r = Pi(t + 1) 7^ i to i, so i executes 04a during slot t + 1 and sets Pi(t + 2) = i. This 
however contradicts the fact Pi(t + 2) = Pi(t + 1). Therefore, r / i and r 7^ Pi(t), i.e., i is "at least 
two levels down" in GM*(t)- D 

Let the depth of a tree be the largest distance between a leaf of the tree and the root; the depth 
of a forest is the largest depth of any tree in the forest. We will use g(-) to denote depth. The 
following lemma uses the previous two lemmas to assert that a forest carrying an invalid maximal 
estimate has its depth decrease by at least one over a time interval of length two. 

Lemma A. 10. Fix some time t > T' , and let M* be the largest estimate value at that time. If 
g(G M *(t + 2))>0, then g{G M *{t + 2)) < g(G M .(t)) - 1. 

Proof. Suppose that g(GM*(t + 2)) > 0. Let us fix a leaf i and a root j in the forest Gjv/*(t + 2) 
such that the length of the path from i to j is equal to the depth of Gm* (t + 2). Let i' be the single 
neighbor of node i in Gm*{P + 2). We first claim that every edge (k, k') on the path from i! to j 



in GM*{t + 2) was also present in GM*(t)- Indeed, by Lemma A. 2 the appearance of a new edge 
(k, k') at time t + 1 or t + 2 implies that node k has in-degree in G{t + 2), which contradicts k 
being an intermediate node on the path from i to j in GM*(t + 2). The same argument establishes 
that M}-(t) = Mfc(t + 1) = M* . Finally, the estimate of k at time t is invalid, for if it were valid, 



it would still be valid at time t + 2 by Lemma A. 7, so i would also have a valid estimate at time 



t + 2, which is false by assumption. Thus we have just established that both the node k and its 
edge (k, k') at time t + 2 belong to Gm*(£)- 

Thus the graph Gm*(£) includes a path from i' to j of length g{GM*{t + 2)) — 1. Moreover, by 



Lemma A. 9, we know that at time t some edges and were present in GM*(t), so the 

path length from il to j" is at least g(GM* (t+2))+l. This proves that g{Gu* it)) > g(GM* (t+2))+l 
and the lemma. □ 

The following lemma analyzes the remaining case of invalidity graphs with zero depth. It shows 
that the invalidity graph will be empty two steps after its depth reaches zero. 

Lemma A. 11. Fix some time t > T' , and let M* be the largest estimate value at that time. If 
Gu*{t + 2) is not empty, then g(GM*(t + 1)) > or g{Gu*{t)) > 0. 

Proof. Let us take a node i £ GM*(t + 2) and let j = Pi{t + 2). It follows from the definition of a 
valid estimate that j 7^ i. This implies that i did not execute 04a (or 01) during slot t + 1. We 
treat two cases separately: 

(i) Node i did not execute 02 during slot t + 1. In this case, Pi(t + 1) = Pi(t + 2) = j and 
Mj(t + 1) = Mj(t + 2) = M*. Besides, there is no "restart" message from j = Pi(t + 1) to i at 
time t + 1, for otherwise i would have executed 04a during slot t + 1, which we know it did not. 



Therefore, (i,j) G E(t+1) by definition of G(t), and Mj(t + 1) = M;(t + 1) = M* by Lemma |A4 
Moreover, neither i nor j have a valid estimate, for otherwise Lemma |A.7| would imply that they 
both hold the same valid estimate at t + 2, in contradiction with i G Gm* (t + 2). So the edge (i,j) 
is present in GM*(t + 1), which has thus a positive minimal depth. 

(ii) Node i did execute 02 during slot t + 1: In that case, there was a message with the value 
Mi(t + 2) = M* from j to i at time t + 1, which implies that Mj(t + 1) = Mj(t + 2) = M*. This 
implies that j did not execute operation 02 during slot t. Moreover, node j did not have a valid 
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estimate at time t + 1. Otherwise, part (a) of Lemma A. 7 implies that j has a valid estimate at 



time t + 2, and part (b) of the same lemma implies there was not a "restart" message from j at 
t + 2, so that G + 2). This would in turn imply that i has a valid estimate at time t + 2, 
contradicting z G GM*{t + 2). To summarize, j has an invalid estimate M* at time i + 1 and did 
not execute 02 during slot t. We now simply observe that the argument of case (i) applies to j at 
timet + 1. □ 

The next lemma asserts that the largest invalid estimates are eventually purged, and thus that 
eventually, all remaining largest estimates are valid. 

Lemma A. 12. Fix some time t > T' , and let M* be the largest estimate value at that time. 
Eventually Gm* if) is empty. 



Proof. Lemma A. 10 implies there is a time t! > T' after which g(GM*(t")) 



Lemma A. 11 then implies that GM*{t) is empty for all t > t' + 2. 



for all t" > t'. 

□ 



Proof of Theorem \5.1\ Let M = maxj Uj(T'). It follows from the definition of a valid estimate that 
any node holding an estimate Mj(i) > M at time t >T' has an invalid estimate. Applying Lemma 



We are now ready for the proof of the main theorem. 



A. 12 repeatedly shows the existence of some time T> T' such that when t > T, no node has an 



estimate larger than M, and every node having an estimate M has a valid estimate. 

We will assume that the time t in every statement we make below satisfies t >T. Define Z{t) 
as the set of nodes having the estimate M at time t. Every node in Z{t) holds a valid estimate, 
and Z(t) is never empty because Lemma 



A.5 



implies that Mi(t) > M for every i with m = M. 
Moreover, it follows from Lemma A. 7 and the definition of validity that any node belonging to 
some Z(t) will forever afterwards maintain M{(t) = M and will satisfy the conclusion of Theorem 
I5T1 

We conclude the proof by arguing that eventually every node is in Z{t). In particular, we will 
argue that a node i adjacent to a node j G Z{t) necessarily belongs to Z{t + 2). Indeed, it follows 
from Lemma A. 7 that node j sends to i a message with the estimate M at time t+1. If i G Z{t + 1), 
then i G Z(t + 2); else Mj(t + 1) < M, i executes 02 during slot t + 1, and sets Mj(t + 2) = M, so 
indeed i G Z(t + 2). □ 



B The Time to Termination 

The aim of this appendix is to prove an 0(n 2 K 2 ) upper bound on the time to termination of the 
interval- averaging algorithm from Section |6j The validity of Theorems 6.1 and 6.2 follows readily 



because finite- memory algorithms described in Section [4] all consist of having the nodes run a fixed 
number of interval-averaging algorithms. 

We will use the notation M'(t) to denote the largest estimate held by any node at time t or in 
the n time steps preceding it: 

M'(t) = max Mi(k). 

i = 1, , n 

k = t,t — 1, . . . ,t — n 

For M'{t) to be well defined, we will adopt the convention that for all negative times k, Mi(k) = 
Ui(0). 
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Lemma B.l. In the course of the execution of the interval-averaging algorithm, M'(t) never 
increases. 



Proof. Fix a time t. We will argue that 



Mi(t + 1) < M'(t) 



(B.5) 



for each i. This clearly implies M'{t + 1) < M'(t). 

If Mi(t + 1) < Mi(t), then Eq. pT5] ) is obvious. We can thus suppose that Mi(t + 1) > Mj(t). 
There are only three boxes in Figure |2| which result in a change between M{(t) and Mj(t + 1). These 
are 02, 01, and 04a. We can rule out the possibility that node i executes 02, since that merely 
sets Mi(t + 1) to some Mj(t), and thus cannot result in Mi(t + 1) > M'(t). 

Consider, then, the possibility that node i executes Ol or OAa, and as a consequence Mj(t+1) = 
Ui{t). If Ui{t) < Ui(t — 1), then we are finished because 

Mi(t + 1) = Ui (t) < Ui (t - 1) < Mi{t), 

which contradicts the assumption Mj(t + 1) > Mj(t). Note that the last step of the above chain of 



inequalities used Lemma A. 5 



Thus we can assume that Ui{t) > Ui(t — 1). In this case, i must have fulfilled acceptance from 
some node j during slot t — 1. Let t the time when node j received the corresponding request 
message from node i. The rules of our algorithm imply that Ui(t) = iij(t — 1), and that the quantity 
w sent by j to i in response to the request is no greater than ^(uj(i) — Ui(i)). This implies that 
Ui(t) = Ui(t — 1) + w < Uj (i) . [JH: I've add some more explanations on why Uj(t) < iij(t)] 

Crucially, we have that t £ [t — 1 — n, t — 1] , since at most n + 1 time steps pass between the time 
node j receives the request message it will accept and the time when node i fulfills j's acceptance. 
So 

Mi(t + 1) = Ui{t) < Uj(i) < Mj(i+ 1) < M'(t). 

We have thus showed that Mj(i + 1) < M'{t) in every possible case, which implies that M'(i+ 1) < 
M'(t). □ 

Lemma B.2. Consider the maximum tracking algorithm. If each Ui(t) is constant for t G 
[to, to + An], then at least one of the following two statements is true: 

(a) M'(t + 3n)<M'(to). 

(b) Mi (to + An) = maxj Uj(to) for every i. 

Proof. Suppose first that no node holds an estimate equal to M'(to) at some time between to + 2n 



and to + 3n. Then it follows from the definition of M'{t) and its monotonicity (B.l ) that condition 
(a) holds. Suppose now that some node holds an estimate equal to M'(to) at some time between 
to + 2n and to + 3n. The definition of M'(t) and the monotonicity of maxj Mj(t) when all u% 
are constant (Lemma A. 6) imply that M'(to) = maxj Mj(t) for all t S [to, to + 3n]. It follows 



from repeated application of Lemmas A. 10 and |A.lT (similarly to what is done in the proof of 
Proposition A. 12) that every estimate M'(to) at time to + 2n is valid, which by definition implies 
the existence of at least one node i with Uj(to) = M'(to). Besides, since Mj(t) > Uj(t) holds for all 
i and t by Lemma A. 5 and since we know that M'(to) = maxj Mj(t) for all t G [to, + 3n], we have 
M'(to) = maxjiij(to). As described in the proof of Theorem 5.1, this implies that after at most 2n 
more time steps, Mj(t) = M'(to) holds for every i, and so (b) holds. □ 

The next lemma upper bounds the largest time before some request is accepted or some outdated 
estimate is purged from the system. Recall that x = (Y^l Xi)/n. 
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Lemma B.3. Consider the interval-averaging algorithm described in Sections^and^ For any 
to, at least one of the following is true: 

(a) Some node accepts a request at some slot t G [to, to + 8n— 1]. 

(b) We have M'(t + 1) < M'(t) for some t £ [to + l,t + 3n]. 

(c) All m remain forever constant after time to + n, with it, £ {|_^Jj [^[}, and all M,(t) remain 
forever constant after time to + 5n, luit/i Mj = [af| . 

Proof. Suppose that condition (a) does not hold, i.e., that no node accepts a request between to 
and to + 8n. Since an acceptance message needs to travel through at most n — 2 intermediate nodes 



before reaching the originator of the request (cf. Lemma 6.3), we conclude that the system does 
not contain any acceptance messages after time to + n. As a result, no node modifies its value Ui(t) 
between times to + n and tp + 8n. Abusing notation slightly, we will call these values itj. 



It follows from Lemma B.2 that either condition (b) holds, or that there is a time t < to + 5n at 
which Mj(t) = max.,- Uj for every i. Some requests may have been emitted in the interval [to, to+5n]. 
Since we are assuming that condition (a) does not hold, these requests must have all been denied. 



It follows from Lemma 6.3 that none of these requests is present by time to + 7n. Moreover, by 
the rules of our algorithm, once Mj becomes equal to maxj Uj for every node i, every node with 
Ui < maxj Uj — 2 will keep emitting requests. Using an argument similar to the one at the end of 
the proof of Proposition |6.1[ if such requests are sent, at least one must be accepted within n time 
steps, that is, no later than time to + 8n. Since by assumption this has not happened, no such 
requests could have been sent, implying that u, > maxj Uj — 1 for every i. Moreover, this implies 
that no request messages/acceptance are ever sent after time to + In, so that Ui never change. It 
is easy to see that the M{ never change as well, so that condition condition (c) is satisfied. □ 

We can now give an upper bound on the time until our algorithm terminates. 

Theorem B.l. The interval- averaging algorithm described in Section^ terminates after at 
most 0(n 2 K 2 ) time steps. 

Proof. Consider the function V(t) = Yli=i ( u i(t) ~ u) 2 , where u is the average of the x,, which is 



also the average of the in, and where the iii(t) are as defined before Lemma 6.4. Since Ui(t) € 
{0, 1, . . . , K} for all i, one can verify that V(0) < |n]f 2 . Moreover, as explained in the proof of 



Lemma 6.4, V(t) is non-increasing, and decreases by at least 2 with every request acceptance. 
Therefore, a total of at most ^nK 2 requests can be accepted. Furthermore, we showed that 
M'(t) is non-increasing, and since M'(t) always belongs to {0, 1, . . . ,K}, it can strictly decrease 



\nK 2 ■ 8n + K ■ 3n+5 time steps. 



at most K times. It follows then from Lemma B.3 that condition (c) must hold after at most 



Recall that in parallel with the maximum-tracking and averaging algorithm, we also run a 
minimum tracking algorithm. In the previous paragraph, we demonstrated that condition (c) of 



Lemma B.3 holds, i.e. remain fixed forever, after n 2 K 2 + K • 3n time steps. A similar argument 



to Lemma |B.2 implies that the minimum algorithm will reach a fixed point after an additional 



(3K + 4)n steps. 

Putting it all together, the algorithm reaches a fixed point after n 2 K 2 + (6K + 4) • n steps. □ 



We note that there are cases where the running time of interval averaging is quadratic in n. 
For example, consider the network in Figure [7j consisting of two arbitrary connected graphs G\, G2 
with n/3 nodes each, connected by a line graph of n/3 nodes. Suppose that K = 2, and that Xi = 
if i G G\, Xi = 2 if i G G2, and Xj = 1 otherwise. The algorithm will have the nodes of G\ with 
ui = send requests to nodes j in Gi with Uj = 2, and each successful request will result in the 
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Figure 7: A class of networks and initial conditions for which our algorithm takes 0(n 2 ) time steps 
to reach its final state. 

pair of nodes changing their values, Ui and Uj, to 1. The system will reach its final state after 
n/3 such successful requests. Observe now that each successful request must cross the line graph, 
which takes n/3 time steps in each direction. Moreover, since nodes cannot simultaneously treat 
multiple requests, once a request begins crossing the line graph, all other requests are denied until 
the response to the first request reaches G±, which takes at least 2n/3 time steps. Therefore, in 
this example, it takes at least 2n 2 /9 time steps until the algorithm terminates. 
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